| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceCVE-2026-118772 · GHSA-4528-X5FX-H6HG |
@hapi/joijoi |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)CVE-2026-113650 · GHSA-C9RX-X947-FP3H |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)CVE-2026-113657 · GHSA-374F-7CHJ-9948 |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsCVE-2026-113661 · GHSA-CV27-6WVH-8X7J |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderCVE-2026-113654 · GHSA-X3Q4-9HXX-GX8M |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| joi messages compilation allows prototype replacement through __proto__ error codesCVE-2026-90771 · GHSA-WR44-6HXH-3JWQ |
joiGatekeeper 3/gatekeeper/gatekeeper-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksCVE-2026-54272 · GHSA-22JQ-VG5J-6VGG |
ip-addressMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Unauthenticated Denial of Service via Inefficient Route MatchingCVE-2026-55685 · GHSA-CHX6-HX7R-MCP5 |
react-routerExploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-13311 · GHSA-395F-4HP3-45GV |
shell-quoteCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| node-tar: Decompression/parse DoS via unlimited inputCVE-2026-59873 · GHSA-23HP-3JRH-7FPW |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| undici vulnerable to cross-user information disclosure via shared cache whitespace bypassCVE-2026-9678 · GHSA-PR7R-676H-XCF6 |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| undici vulnerable to HTTP header injection via Set-Cookie percent-decodingCVE-2026-9679 · GHSA-P88M-4JFJ-68FV |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
